In 2024, a near supply chain attack on XZ Utils exposed a critical weakness in the global software ecosystem: widely used infrastructure depended on a single, under-supported maintainer. This was not an isolated incident. From the Log4j vulnerability to Heartbleed, systemic risks continue to emerge from underfunded and overstretched Open Source projects. In the Python ecosystem, this dependency is even more pronounced. Modern applications often rely on hundreds of packages from PyPI, many of which are maintained by a small number of contributors. These packages power everything from fintech systems to machine learning pipelines, yet their sustainability is rarely considered. This talk reframes Open Source as critical infrastructure rather than community goodwill. It explores the security, economic, and governance implications of this shift, with particular attention to how contributors in Africa are affected by limited resources, funding, and access. Attendees will gain a deeper understanding of the risks in the Open Source supply chain, why these issues matter to Python developers, and how both individuals and organizations can contribute to building a more secure and sustainable ecosystem.